match

type ApplyTo struct {
	Groups   []string `json:"groups,omitempty"`
	Kinds    []string `json:"kinds,omitempty"`
	Versions []string `json:"versions,omitempty"`
}

type DummyCRD struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadataDummy,omitempty"`

	Match `json:"embeddedMatch,omitempty"`
}

type Kinds struct {
	// APIGroups is the API groups the resources belong to. '*' is all groups.
	// If '*' is present, the length of the slice must be one.
	// Required.
	APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"`
	Kinds     []string `json:"kinds,omitempty"`
}

type Match struct {
	// Source determines whether generated or original resources are matched.
	// Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of
	// `Generated` will only match generated resources, while `Original` will only
	// match regular resources.
	// +kubebuilder:validation:Enum=All;Generated;Original
	Source string  `json:"source,omitempty"`
	Kinds  []Kinds `json:"kinds,omitempty"`
	// Scope determines if cluster-scoped and/or namespaced-scoped resources
	// are matched.  Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`)
	Scope apiextensionsv1.ResourceScope `json:"scope,omitempty"`
	// Namespaces is a list of namespace names. If defined, a constraint only
	// applies to resources in a listed namespace.  Namespaces also supports a
	// prefix or suffix based glob.  For example, `namespaces: [kube-*]` matches both
	// `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both
	// `kube-system` and `gatekeeper-system`.
	Namespaces []wildcard.Wildcard `json:"namespaces,omitempty"`
	// ExcludedNamespaces is a list of namespace names. If defined, a
	// constraint only applies to resources not in a listed namespace.
	// ExcludedNamespaces also supports a prefix or suffix based glob.  For example,
	// `excludedNamespaces: [kube-*]` matches both `kube-system` and
	// `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and
	// `gatekeeper-system`.
	ExcludedNamespaces []wildcard.Wildcard `json:"excludedNamespaces,omitempty"`
	// LabelSelector is the combination of two optional fields: `matchLabels`
	// and `matchExpressions`.  These two fields provide different methods of
	// selecting or excluding k8s objects based on the label keys and values
	// included in object metadata.  All selection expressions from both
	// sections are ANDed to determine if an object meets the cumulative
	// requirements of the selector.
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
	// NamespaceSelector is a label selector against an object's containing
	// namespace or the object itself, if the object is a namespace.
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
	// Name is the name of an object.  If defined, it will match against objects with the specified
	// name.  Name also supports a prefix or suffix glob.  For example, `name: pod-*` would match
	// both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.
	Name wildcard.Wildcard `json:"name,omitempty"`
}

type Matchable struct {
	Object    client.Object
	Namespace *corev1.Namespace
	Source    types.SourceType
}

type MutationApplyTo struct {
	ApplyTo `json:",inline"`
	// Operations specifies which admission operations (CREATE, UPDATE, *) should trigger
	// this mutation. If empty, all operations supported by the mutation webhook are allowed for backward compatibility.
	// The Gatekeeper mutation webhook currently only processes CREATE and UPDATE operations, so those are the only
	// concrete values accepted. DELETE and CONNECT are rejected until the mutation webhook supports them.
	// "*" means all operations the mutation webhook currently supports and will broaden automatically if support
	// for additional operations is added in a future release.
	// +kubebuilder:validation:items:Enum=CREATE;UPDATE;*
	Operations []admissionregistrationv1.OperationType `json:"operations,omitempty"`
}